{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-19590",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-19590",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-01T17:04:43.060Z",
    "updatedAt": "2026-09-03T14:32:10.000Z",
    "importedAt": "2026-10-24T01:57:55.771Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.",
      "affected": [
        {
          "vendor": "OpenAI",
          "product": "Codex Desktop",
          "platforms": [
            "macOS"
          ],
          "versions": [
            {
              "version": "260202.0859",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "26.513.31313"
            },
            {
              "version": "26.519.22136",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "OpenAI",
          "product": "Codex Desktop",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "26.304.38",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "26.513.40821"
            },
            {
              "version": "26.519.21041",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "OpenAI",
          "product": "Codex Desktop (Microsoft Store package)",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "26.304.38.0",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "26.513.4821.0"
            },
            {
              "version": "26.519.2081.0",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  }
}